From adfb0de1873078804972804844a4ac4f2edec6b7 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 13 Oct 2021 14:50:42 +0100 Subject: [PATCH 1/2] Windows: Set a 100Gb VAD max size for vadinfo --- volatility3/framework/plugins/windows/vadinfo.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 51002d0ed..2b5bc8701 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -35,7 +35,7 @@ class VadInfo(interfaces.plugins.PluginInterface): _required_framework_version = (2, 0, 0) _version = (2, 0, 0) - MAXSIZE_DEFAULT = 0 + MAXSIZE_DEFAULT = 100 * 1024 * 1024 * 1024 # 100 Gb def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) From 20ca165d0f1fc49c8d9011c7e3000e07483d6665 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 27 Oct 2021 23:19:30 +0100 Subject: [PATCH 2/2] Windows: Lower the vadlimit on MHL's advice --- volatility3/framework/plugins/windows/vadinfo.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 2b5bc8701..9fa1458d1 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -35,7 +35,7 @@ class VadInfo(interfaces.plugins.PluginInterface): _required_framework_version = (2, 0, 0) _version = (2, 0, 0) - MAXSIZE_DEFAULT = 100 * 1024 * 1024 * 1024 # 100 Gb + MAXSIZE_DEFAULT = 1024 * 1024 * 1024 # 1 Gb def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs)